From 16021d3953f8435449f63dbb25442702a9f45e76 Mon Sep 17 00:00:00 2001 From: tegwick Date: Tue, 13 Oct 2026 21:10:23 +0200 Subject: [PATCH] docs: distinguish remaining custody callers from repaired SOPS paths Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a1346b-72a4-7d40-b8bd-8b8ca346cfa2 --- .../NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md b/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md index c2c4fc4..e1793a7 100644 --- a/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md +++ b/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md @@ -84,8 +84,9 @@ Concrete uncovered callers remain (T02 stays progress): updates, retained rollback custody and native multi-consumer acceptance. The legacy replacement paths now refuse before mutation; this is not rotation closure. - PostgreSQL/privacyIDEA/LLDAP/Authelia generators and the batch apply caller - are repaired below. Other diagnostic/bootstrap/key-export callers and direct - SOPS edit/encrypt/rotate are repaired below; native effect/recovery evidence is mandatory. + and direct SOPS edit/encrypt/rotate are repaired below. Other diagnostic, + bootstrap and key-export callers remain open; native effect/recovery evidence + is mandatory. 2026-10-12 Make caller repair: sops-setup now validates only the public recipient; creds-init no longer requires or installs a permanent private key. sops-decrypt